Most systems built on a model put their rules in the prompt. That means the rules are a request, and a request is only as good as the model's mood, the length of the conversation, and whoever worded the last message.
Here the parts that matter are outside the model. This page says which parts, and is equally clear about the part that is not.
What is enforced
First, one word this page needs. The registry is the node's own list of what exists: which agents there are, which tools each one may use, who each may write to. It is a table on your machine, not a document and not a paragraph in an instruction. Everything below is a line in it, and every line is checked in code before anything happens.
Which tools an agent may use. A tool is granted to an agent explicitly. An agent cannot reach a tool it was not granted, whatever its prompt says, whatever it is asked, and whatever it believes about itself. There is no path from wording to capability.
Who it may talk to. Channels are bound to agents. An inbound message resolves to an agent through that binding, and an outbound one is checked against the addresses that agent was allowed to write to. An unknown sender does not start work, and an unapproved recipient does not receive anything.
Where mail may go. Outbound mail passes a single check on a single path before it is handed to the transport.
The prompt cannot grant anything
An agent's instructions are composed from the registry every time it runs: its own definition, the usage text of each tool it holds, and the rules for its categories. The file on disk is output, not input. Edit it and the next run overwrites it; edit it and nothing about what the agent may do has changed.
This is checkable from outside without our help. One request returns the composed prompt of any agent, and you can see that it was assembled from parts. Change a rule in the registry and every agent carrying that rule changes with it, in one step, verifiably.
Approvals
Some things an agent writes are routine: an opening time, a direction, an answer about what you sell. Some things commit you to a customer: a price, a booking, a promise about a date. The second kind can be held until you say yes. It waits in the panel, you approve or reject it, and only then does it reach the customer.
You decide which is which. The rules are set to match how your business already works, during setup and afterwards whenever it changes. If quotes always need your eyes, say so and quotes always wait. If a class of work never does, it never waits. Nobody else's default applies to you.
One thing worth understanding before you rely on it. There are two ways a piece of work ends up held, and they are not equally strong.
As a defined procedure it is certain. "Every quote waits for me" is a rule about a kind of work. It applies each time that kind of work is produced, and nothing has to recognise anything.
Left to the agent it is a judgement. The agent has been told to hold whatever commits you, and it has to work out that this particular message is such a thing. Usually it does. Sometimes it reads as routine a sentence you would have wanted to see first.
So if a kind of work must never go out without you, define it as a procedure and do not lean on the agent to spot it. That is a short conversation at setup, and it is the difference between a guarantee and a strong tendency.
What you see
Every action is in the panel as it happens, and every permission change is in the same log as the work it affected. Not a summary written afterwards: the record itself, in order, append-only.